Last Modified: Oct 12, 2026
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9
Opened: Jun 04, 2025 Severity: 3-Major
When you configure overlapping or nested IP address exceptions with different actions, an address covered by a more specific Never Block exception can be blocked. Requests from that address report the “Illegal URL” and “IP is blacklisted” violations even though the address should remain unblocked.
Traffic that should be allowed by a more specific Never Block exception is blocked instead. Legitimate requests are denied and reported as policy violations because the more specific exception is not honored.
Multiple IP address exceptions have overlapping or nested IPv4 address ranges and different actions, such as a more specific Never Block range inside a broader Always Block range.
None
None